It didn't consider the case of the incoming size not allowing for the 2*data_size range for t_buf->{prod,cons} Signed-off-by: Jan Beulich --- 2010-06-15.orig/xen/common/trace.c 2010-06-28 11:58:37.000000000 +0200 +++ 2010-06-15/xen/common/trace.c 2010-06-28 11:58:37.000000000 +0200 @@ -77,11 +77,16 @@ static u32 tb_event_mask = TRC_ALL; /** * check_tbuf_size - check to make sure that the proposed size will fit - * in the currently sized struct t_info. + * in the currently sized struct t_info and allows prod and cons to + * reach double the value without overflow. */ -static inline int check_tbuf_size(int size) +static int check_tbuf_size(u32 pages) { - return (num_online_cpus() * size + T_INFO_FIRST_OFFSET) > (T_INFO_SIZE / sizeof(uint32_t)); + u32 size = pages * PAGE_SIZE; + + return (size / PAGE_SIZE != pages) || (size + size < size) || + (num_online_cpus() * pages + T_INFO_FIRST_OFFSET > + T_INFO_SIZE / sizeof(uint32_t)); } /**